Threat database

The llhttp library version 8.1.1 contains two request smuggling vulnerabilities. These vulnerabilities affect the aiohttp library versions from 1.16.2 up to but not including 1.16.27, as aiohttp includes llhttp as a dependency. The vulnerabilities are resolved by upgrading to llhttp version 9 or later, which is included in aiohttp version 3.8.6 and above. No detailed technical information or exploitation details have been disclosed yet.

The llhttp library version 8.1.1 contains two request smuggling vulnerabilities. These vulnerabilities affect the aiohttp package when it depends on this vulnerable llhttp version. The vulnerabilities are resolved by upgrading to llhttp version 9 or later, which is included starting from aiohttp version 3.8.6. The affected versions of the Black package are from 19.10b0_3 up to but not including 23.10.0. No detailed technical information or exploitation details have been disclosed yet.

CVE-2026-44898 is a medium severity cross-site scripting (XSS) vulnerability in the Mistune TOC component's render_toc_ul() function. It affects recon-ng versions >=5.1.1_1 and <5.1.2_4, as well as several other specific Mistune versions. The vulnerability occurs because heading IDs and text are inserted into HTML anchor tags without proper escaping, allowing attackers to inject arbitrary HTML and script code when heading IDs are derived from user input. A patch is available to address this issue.

A CSS injection vulnerability exists in the Image directive plugin of recon-ng due to improper validation of the :width: and :height: options. The regex used for validation only anchors at the start of the string, allowing values that begin with digits but contain arbitrary CSS to pass. This enables unescaped CSS injection into the style attribute of rendered images, which can be exploited for phishing or UI redressing attacks. The vulnerability affects specific recon-ng versions and a patch is available.

A local privilege escalation vulnerability exists in the TensorFlow HDF5 library due to an uncontrolled search path element. This vulnerability is identified as CVE-2026-2492 and affects Microsoft products, specifically versions 2.0 and 3.0. No CVSS score or detailed technical exploit information is provided. No patch or remediation guidance is currently available from the vendor. The vulnerability relates to CWE-427, which involves unsafe search path elements that could be exploited to escalate privileges locally.

A cross-site scripting (XSS) vulnerability exists in Portabilis i-Diario up to version 1.5.0 in the Registro das atividades component, specifically in the /registros-de-conteudos-por-disciplina/ file. The vulnerability arises from improper handling of the 'Registro de atividades/Conteúdos' argument, allowing remote attackers to inject malicious scripts. The vulnerability is classified as medium severity with a CVSS score of 3.5. The vendor was notified but has not responded, and no patch or remediation is currently available. Public exploit details have been disclosed, but no active exploitation in the wild is known.